PyPI/datamodel-code-generator CVE-2026-107377: high 7.5, EPSS 0.53%
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
Action: Upgrade datamodel-code-generator to 0.81.0 or later.
pip install datamodel-code-generator==0.81.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.59.0 | 0.81.0 | - |
Fixed versions
| 0.81.0 |
Sources
- osv: GHSA-77xj-x4rm-935c
- https://github.com/datamodel-code-generator/datamodel-code-generator/security/advisories/GHSA-77xj-x4rm-935c
- https://github.com/datamodel-code-generator/datamodel-code-generator/commit/5e94b8f4203198798ec66b8e48217f70af69a0dc
- https://github.com/datamodel-code-generator/datamodel-code-generator
- https://github.com/datamodel-code-generator/datamodel-code-generator/releases/tag/0.81.0
CVE-2026-107377 · published · modified · JSON